[pwdisswordfishc]

Only as inevitable as the dearth of interpolation/parametrized query primitives… though whether the industry has actually learnt the bitter lessons of SQL injection remains to be seen. I don’t hold my hopes up too much.

[pydry]

You can just bypass the injection risk entirely by hardcoding the values as this example demonstrates:

https://news.ycombinator.com/item?id=40246089

(I'm being sarcastic, obviously. You are 100% right)